Right, but turns out you can do cross-origin POST as well.